CVE-2026-46625 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Prototype pollution in js-cookie allows attackers to inject malicious cookie attributes, bypassing security controls like SameSite or Secure flags.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46625?
CVE-2026-46625 is a high-severity unsafe deserialization vulnerability in Redhat Enterprise Linux, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.
Which versions are affected by CVE-2026-46625?
2 open source packages ship an affected version, including js-cookie. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
js-cookie npm | All versions | 3.0.7 |
js-cookie npm | All versions | 3.0.7 |
Products include Js-Cookie Javascript Cookie, Redhat 3scale Api Management, Redhat Ansible Automation Platform, Redhat Enterprise Linux, Redhat Openshift Ai, Redhat Openshift Lightspeed.
How do I fix CVE-2026-46625?
Upgrade js-cookie to 3.0.7 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-46625 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46625 exists.
Sources
Also known as CLEANSTART-2026-JL16021, CLSA-2026-1782089812, DEBIAN-CVE-2026-46625, ECHO-1569-0744-f0f7, GHSA-qjx8-664m-686j, MINI-4879-mp7p-3fp4 and 16 more.